This recommended practice (RP) of AACE International shall define the expectations, requirements, and practices for developing a risk management (RM) quality program. This RP will identify the quality assurance (QA) process, quality control (QC) process, and related risk management auditing methods for a capital asset portfolio, program or project management organization. The RP expands on TCM sections 11.4, Quality and Quality Management and 11.5, Value Management and Value Improving Practices (VIPs) as applicable to the Risk Management process as described in TCM section 7.6. It includes practices for planning how to develop and implement a quality assurance and quality control platform and a proper auditing program for risk management within a project, a program, or a portfolio. Emphasis will be on a continuous improvement suite of tools aligned with quality management principles applied to the risk management process and considers the cost of quality. This RP is not about governance, risk management and/or compliance for an overall TCM process or management of an enterprise as a whole. It only applies to the risk management process or program within that framework.

The process of risk management interfaces with investment decision making (TCM section 3.3) in consideration of risk prior to initiation of projects, and change management (TCM section 10.3) in which risk cost and time allowances (e.g. contingency and reserves) are assessed and managed during program or project execution. While this RP does not cover those processes per se, the user should ensure that the quality program interfaces appropriately with them.

This RP is intended to provide guidelines (i.e. not a standard) for developing and using a quality assurance and quality control program applicable to risk management.
This recommend practice is intended to be a model that can be used as a basis for planning quality improvement programs for risk management; to help risk, project, and asset program managers discern whether their risk management program is working; and identify where performance improvements are required. It will provide a foundation for not just addressing the overall risk management QA/QC program but specifically developing QA/QC ideas for risk treatment plans as described in RP 63R-11, Risk Treatment. Ideally, the risk management process provides an opportunity for all stakeholders and contracting parties to work together and manage risk (i.e. threats or opportunities) in a way that increases the probability of success of the portfolio, program or project. The implementation of all or part of this RP will depend on the size and complexity of the program or project but the basic processes described should be used in all cases.